3 ms·

I trust the F-Droid store more due to its curated (FOSS-software-only/no-trackers) maintainer based model and default to them if there's an app that I need, esp

by ce4 6y ago

I trust the F-Droid store more due to its curated (FOSS-software-only/no-trackers) maintainer based model and default to them if there's an app that I need, especially simple stuff that tends to mostly be adware on the playstore

FriedrichN 6y ago
On a side note, my bank is now forcing me to use their app which can only be downloaded from the Play Store (which I will never install). When I complained they told me it's because they think it's more secure than their current method which is a card reader, I tried to explain to them the average phone is teeming with malware, but they simply wouldn't believe me. I am currently looking for a new bank.
- hadrien01 6y ago
  You can use AuroraStore from F-Droid, it allows you to download apps from the Play Store without a Google account.
  - simonmales 6y ago
    Nice tip!
    - Daniel_sk 6y ago
      It will probably be not good enough, many banking apps are using Google Safety Net to detect rooted or not Google certified devices with Google Play installed indirectly. AFAIK it's now quite difficult to break. I sort of understand the bank decision on this. There is a lot of malware on Android and users are easily tricked into installing some side-loaded APKs, and there is also a lot of hidden malware on Google Play which is hard to find (e.g. it downloads a payload after the store review is done). This would be a disaster since on Android you can for example use accessibility services to read any input from the user and also control the device. So you can circumvent 2FA and make transactions on behalf of the user on the device. There has been a lot banking malware on Google Play. I think they are getting it a bit under control now, but it's still very dangerous.
      - christophilus 6y ago
        I wonder if it would be possible to have something like qubes or maybe like docker that could run a full-fledged, sandboxed Android instance for a single app, while running FOSS like a sane person as your primary ecosystem.
- ce4 6y ago
  Thats happening a lot, switching your bank wont help at least not for long. I guess "[x] force smartphone users to use the app" is part of some security checklist now. I got a workaround by switching to desktop mode, when that didnt work anymore by using Fennec (FF mobile fork with relaxed addon support) + useragent switcher
sydd 6y ago
kinda similar for me. When I look for a small app like a QR code scanner or a flashlight I search for "QR code scanner open source" or "QR code scanner github" to easily find the open source ones that likely dont contain ads or malware

by ce4 6y ago

FriedrichN 6y ago

On a side note, my bank is now forcing me to use their app which can only be downloaded from the Play Store (which I will never install). When I complained they told me it's because they think it's more secure than their current method which is a card reader, I tried to explain to them the average phone is teeming with malware, but they simply wouldn't believe me. I am currently looking for a new bank.

hadrien01 6y ago
You can use AuroraStore from F-Droid, it allows you to download apps from the Play Store without a Google account.
- simonmales 6y ago
  Nice tip!
  - Daniel_sk 6y ago
    It will probably be not good enough, many banking apps are using Google Safety Net to detect rooted or not Google certified devices with Google Play installed indirectly. AFAIK it's now quite difficult to break. I sort of understand the bank decision on this. There is a lot of malware on Android and users are easily tricked into installing some side-loaded APKs, and there is also a lot of hidden malware on Google Play which is hard to find (e.g. it downloads a payload after the store review is done). This would be a disaster since on Android you can for example use accessibility services to read any input from the user and also control the device. So you can circumvent 2FA and make transactions on behalf of the user on the device. There has been a lot banking malware on Google Play. I think they are getting it a bit under control now, but it's still very dangerous.
    - christophilus 6y ago
      I wonder if it would be possible to have something like qubes or maybe like docker that could run a full-fledged, sandboxed Android instance for a single app, while running FOSS like a sane person as your primary ecosystem.
ce4 6y ago
Thats happening a lot, switching your bank wont help at least not for long. I guess "[x] force smartphone users to use the app" is part of some security checklist now. I got a workaround by switching to desktop mode, when that didnt work anymore by using Fennec (FF mobile fork with relaxed addon support) + useragent switcher

sydd 6y ago

kinda similar for me. When I look for a small app like a QR code scanner or a flashlight I search for "QR code scanner open source" or "QR code scanner github" to easily find the open source ones that likely dont contain ads or malware